Skip to content
OpenAdvisories

Package · Maven

org.owasp.esapi:esapi

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • Medium —
    GHSA-r68h-jhhj-9jvm

    Validator.isValidSafeHTML is being deprecated and will be deleted from org.owasp.esapi:esapi in 1 year

    ### Impact The `Validator.isValidSafeHTML` method can result in false negatives where it reports some input as safe (i.e., returns true), but really isn't, and using that same input as-is can in certain circumstances result in XSS vulnerabilities. Because thi…

    org.owasp.esapi:esapi Maven
  • High 7.5
    GHSA-7c2q-5qmr-v76q

    DoS vulnerabilities persist in ESAPI file uploads despite remediation of CVE-2023-24998

    ### Impact ESAPI 2.5.2.0 and later addressed the DoS vulnerability described in CVE-2023-24998, which Apache Commons FileUpload 1.5 attempted to remediate. But while writing up a new security bulletin regarding the impact on the affected ESAPI `HTTPUtilities.…

    org.owasp.esapi:esapi Maven
  • Medium 5.4
    CVE-2022-24891 Public exploit

    Cross-site Scripting in org.owasp.esapi:esapi -- antisamy-esapi.xml configuration file

    ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, there is a potential for a cross-site scripting vulnerability in ESAPI caused by a incorrect regular expression for "onsiteUR…

    ESAPI esapi-java-legacy org.owasp.esapi:esapi libowasp-esapi-java Debian Ubuntu Maven
  • High 7.5
    CVE-2022-23457 Public exploit

    Path Traversal in ESAPI

    ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the test…

    OWASP ESAPI org.owasp.esapi:esapi org.owasp.esapi:esapi libowasp-esapi-java Debian Ubuntu Maven
  • Medium 5.9
    CVE-2010-3300

    Padding oracle attacks

    It was found that all OWASP ESAPI for Java up to version 2.0 RC2 are vulnerable to padding oracle attacks.

    org.owasp.esapi:esapi Maven
  • Medium —
    CVE-2013-5960

    Missing Cryptographic Step in OWASP Enterprise Security API for Java

    The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0.1 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers …

    org.owasp.esapi:esapi Maven
  • Low —
    CVE-2013-5679

    Missing Cryptographic Step in OWASP Enterprise Security API for Java

    The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to…

    org.owasp.esapi:esapi Maven